MALICIOUS
154
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The PDF file contains numerous embedded URLs, many of which point to compromised WordPress sites utilizing the 'super-forms' plugin for file uploads. The ML classifier and ClamAV detection strongly indicate malicious intent, likely for phishing or distributing further malware. The primary function appears to be acting as a link farm to redirect users to potentially harmful content.
Machine Learning
- Nyx PDF Classifier malicious score 0.9883
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://www.sixteengrams.com/wp-content/plugins/super-forms/uploads/php/files/tn1p88nbncv6780dr7lb7smg77/33300121425.pdf In PDF document text
- https://kassa-evotor.ru/wp-content/plugins/super-forms/uploads/php/files/hv18hm3lirqklb3b9k62l44squ/maropewul.pdfIn PDF document text
- https://myparrotfood.com/user_files/files/zipusafotol.pdfIn PDF document text
- http://www.chinahkcarplate.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c6d00811df6---rugokujige.pdfIn PDF document text
- https://www.havanasalsa-dance-tours.com/wp-content/plugins/super-forms/uploads/php/files/5722c38a3ad902b533565a7f00b02b8b/rekozesizazuma.pdfIn PDF document text
- https://an-professional.ru/img/files/file/483225102.pdfIn PDF document text
- https://forkidsvietnam.vn/wp-content/plugins/super-forms/uploads/php/files/79j381g10sqc252itbk6to60ki/sugovelufilitalatusiv.pdfIn PDF document text
- http://clair-environnement.eu/catalogue_dynamique/file/93332019894.pdfIn PDF document text
- http://www.redactordecontenidos.eu/wp-content/plugins/formcraft/file-upload/server/content/files/160c048f9ab27f---79708390007.pdfIn PDF document text
- http://fteq.ru/files/file/gejonunexotajug.pdfIn PDF document text
- http://vanxuantravel.com/upload/files/27247174143.pdfIn PDF document text
- http://smartcookieacademy.com/wp-content/plugins/formcraft/file-upload/server/content/files/16071a55ccece8---pirabitoxisi.pdfIn PDF document text
- http://kazenergy.kz/wp-content/plugins/formcraft/file-upload/server/content/files/160b51032b1d84---kulegitafisazerusev.pdfIn PDF document text
- http://www.telsercom.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607a0b0eef8ae---debotakefexezeba.pdfIn PDF document text
- http://johndanton.com/customer/3/d/9/3d947ad6ce2568d98b832ccf5548371bFile/53804148728.pdfIn PDF document text
- http://www.fd.ntou.edu.tw/ckfinder/userfiles/files/508975631.pdfIn PDF document text
- http://maxitelt.no/wp-content/plugins/formcraft/file-upload/server/content/files/1610b1f161df38---taraw.pdfIn PDF document text
- https://afmiletisim.com/resimler/files/vatudanumaxaboruju.pdfIn PDF document text
- http://drstevealbrecht.com/wp-content/plugins/super-forms/uploads/php/files/105274304140db6eaff2ea570a52e0e1/81410951330.pdfIn PDF document text
- https://www.kasekimi.com/wp-content/plugins/formcraft/file-upload/server/content/files/16081ac32bb3d6---81578570267.pdfIn PDF document text
- http://www.hkwebdesign.com.hk/wp-content/plugins/formcraft/file-upload/server/content/files/160c406558d8d3---93243839764.pdfIn PDF document text
- http://surrattsville69.com/clients/8/81/8122276c22396d7fa0996010cc369f50/File/24502374891.pdfIn PDF document text
- http://fashionflutters.com/ckfinder/userfiles/files/reline.pdfIn PDF document text
- http://www.optionassurance.ca/wp-content/plugins/formcraft/file-upload/server/content/files/1608ed760ebf51---70213630041.pdfIn PDF document text
- http://psychologkmalinowska.pl/ckfinder/userfiles/files/21301847275.pdfIn PDF document text
- https://feedproxy.google.com/~r/Uplcv/~3/3vuEKuznOb8/uplcv?utm_term=cambridge+ielts+book+5+reading+test+1+answersPDF link annotation
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000be4c.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xBE4C | 15220 bytes |
SHA-256: f142bccaf446fbb0f323fb864b8ef99de6869cdd50bae27f931ffa820e08b37c |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.